One form of conventional digital video transmission involves transmitting an MPEG-2 Transport Stream (TS) consisting of a series of digital packets of information. The information stored with the TS can include Key Length Value (KLV) metadata. In some situations, the TS may be transmitted from a higher security domain to a lower security domain. In other situations, the TS may be transmitted from a lower security domain to a higher security domain. The TS packets often are included within UDP packets for transmission.
When the TS is transmitted from a higher security domain to a lower security domain, it is important to ensure that the transmission of the content of such TS does not violate any security policy. For example, the video content of TS may include KLV metadata indicating that the associated video is designated Top Secret. Thus, it is important to ensure that the transfer across the security domains does not permit unauthorized, uncontrolled distribution of material, e.g., that such Top Secret video is not transmitted to a lower security domain. Similarly, when the TS is transmitted from a lower security domain to a higher security domain, it is important to ensure that no malware or other inappropriate information/data (e.g., botnets or “dirty” words) exists within the KLV metadata.
Highly engineered solutions, such as the Owl Computing Technologies Dual Diode, (described in U.S. Pat. No. 8,068,415, the disclosure of which is incorporated herein by reference) provide a direct point-to-point optical link between network domains in the low-to-high direction or in the low-to-high direction. The unidirectionality of the data transfer is enforced in the circuitry of the network interface cards at both network endpoints and in the cable interconnects. In this way, the hardware provides an added layer of assurance of unidirectional information flow and non-bypassable operation. In contrast to software based one-way data transfer systems, it is easy to prove that data is not bypassing the Dual Diode.
In such systems, shown in block diagram form in FIG. 1, a first server (the Blue Server) 101 includes a transmit application 102 for sending data across a one-way data link, e.g., optical link 104, from a first network domain coupled to server 101 to a second network domain coupled to server 111. First server 101 also includes a transmit (here a phototransmission) component, e.g., optical emitter 103. Transmit application 102 provides data to the optical emitter for transmission across the optical link 104. A second server (the Red Server) 111 includes a receive (here a photodetection) component, e.g., optical detector 113, for receiving data from the optical link 104, which data is then provided to the receive application 112 for further processing. The first server 101 is only able to transmit data to second server 111, since it does not include any receive circuitry (e.g., an optical detector comparable to detector 113) and the second server 111 is only able to receive data from first server 101, since it does not include any transmit circuitry (e.g., an optical emitter comparable to emitter 103).
It is an object of the present invention to provide a system for real-time cross-domain system packet filtering.